Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Alexey Melnikov <[e-mail]>]

On 13/06/2015 01:31, D. J. Bernstein wrote:
> Alexey Melnikov writes:
>> After discussing answers to this poll chairs concluded that despite
>> security limitations of Initiliase-Update-Finalise (IUF) APIs on
>> verifier's end, there is rough consensus that any recommended CFRG
>> signature scheme should support such APIs.
> I can't figure out what this statement means. Can you please clarify
> what you're saying the rough consensus is?
>
> Taking, e.g., Ed25519 as an example: Would recommending
>
>     * Ed25519(m) as the higher-security default and
>     * Ed25519(SHA-3-512(m)), with an IUF API, for protocols that want
>       small devices to be able to handle large messages in one pass
>
> meet the requirement to "support" an IUF API?
>
> Or are you saying that the recommendation would have to be just
> Ed25519(SHA-3-512(m)), and that there's rough consensus against
> splitting out the Ed25519(m) layer for protocols that want the higher
> security?
The rough consensus is that CFRG EC signature recommendation to IETF 
would have to provide IUF API.

In your example, this means that "Ed25519(SHA-3-512(m)), with an IUF 
API" satisfies the requirement and CFRG poll result doesn't say anything 
about (doesn't recommend and doesn't prohibit) "Ed25519(m) as the 
higher-security default".